Computer systems today are subject to a variety of attacks that can disrupt or disable expected operation of a computer system and cause the system to behave in damaging or undesirable ways. Computer viruses, worms, and trojan horse programs are examples of different forms of attack. Attacks can also come from unscrupulous users of a computer system or remote hackers. Often these attacks take the form of attempts to modify existing program code executed by the computer system or attempts to inject new unauthorized program code at various stages of normal program execution within the computer system. Systems and methods for preventing such malicious attacks are becoming increasingly important.
Generally speaking, such attacks are implemented by causing the computer to execute foreign code. “Foreign” code, in this case, refers to code that is not intended or expected to execute in the process space of a particular program. It is typically written by a hacker to get into the process space of a program to accomplish some end, such as to delete, corrupt, or manipulate code or data for some other purpose, like unlawfully making unauthorized copies of music.
Preventing such attacks by foreign code assists in assuring the behavioral integrity of a computer system (or, at least, a particular program). One way to maintain integrity is to perform module authentication, in which the security of one or more software modules is protected against tampering. This provides a level of protection against malicious changes to the software such as code patching, redirection, and software breakpoints.
One form of module authentication is to ensure that content contained in the software module is unchanged (or, at least, that the portions of the module that are not expected to change, such as the code portions, actually remain unchanged). This may be done via static module authentication. Static module authentication is the process of verifying the persistently stored image of the module, which in some cases can be thought of as the “on-disk” module. For example, one mechanism to check the module on-disk may be accomplished by hashing the file and comparing the resulting hash value with a pre-computed hash value of the file that has been signed by a trusted signatory.
The process of hashing, is a well-known cryptographic technique for identifying data with a relatively unique, but substantially smaller representation than the original data. The hash can be taken on a binary source of arbitrary length, and the result of the hashing computation is a smaller, usually fixed-size piece of binary data known as a hash, hash value, or digest. For example, FIPS SHA-1 (Federal Information Processing Standards Secure Hash Algorithm 1) produces a 20-byte long hash regardless of the amount of data that is processed. A good hashing algorithm, like SHA-1, will produce significantly different hash values even for minute changes in the source data, or binary file in this case. Thus, when the expected attack is modification of the stored code, hashing is very effectively at allowing the modification to be detected.
However, not all attacks come in the form of modifications to the stored code. Some attacks are leveled without any modification to the program itself, but rather by modifying the runtime data in such a way that the program will jump into some foreign code created by a hacker, and then execute the foreign code in the program's address space. It would be advantageous to prevent all these kinds of foreign code attacks by recording stack and call tree information of a program, and then during the execution of that program, use this information to compare the actual execution sequence of the program to the intended execution of the program, where the actual execution is determined by stack walking and the obtaining of return addresses on the stack, and the intended execution of the program is obtained from the call tree information.